admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' of github.com:splunk/security-content into tf23

Browse Source
This commit is contained in:
Xiao Lin
2021-10-09 08:22:12 -07:00
parent aa9dc8cacc 8a09315e93
commit 50c45da030
9 changed files with 86 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
automated_detection_testing/ci/attack_range_for_testing/requirements.txt
+1 -1
View File
@@ -1,4 +1,4 @@
ansible==3.1.0
ansible==4.2.0
ansible-runner==1.4.7
apipkg==1.5
aspy.yaml==1.3.0
automated_detection_testing/ci/detection_testing_batch/requirements.txt
+1 -1
View File
@@ -1,4 +1,4 @@
ansible==2.9.20
ansible==4.2.0
ansible-runner==1.4.4
attackcti==0.3.4.3
boto3==1.11.0
automated_detection_testing/requirements.txt
+4 -4
View File
@@ -1,5 +1,5 @@
ansible==3.4.0
ansible-runner==1.4.7
ansible-runner==2.0.2
apipkg==1.5
aspy.yaml==1.3.0
atomicwrites==1.4.0
@@ -7,13 +7,13 @@ attackcti==0.3.4.3
attrs==21.2.0
azure-common==1.1.27
azure-core==1.18.0
azure-identity==1.6.0
azure-identity==1.6.1
azure-mgmt-compute==20.0.0
azure-mgmt-core==1.2.1
azure-mgmt-network==19.0.0
azure-mgmt-resource==17.0.0
bcrypt==3.2.0
boto3==1.17.104
boto3==1.18.38
botocore==1.20.105
certifi==2021.5.30
cffi==1.14.5
@@ -45,7 +45,7 @@ path==15.1.2
path.py==12.5.0
pexpect==4.8.0
pluggy==0.13.1
pre-commit==2.13.0
pre-commit==2.15.0
protobuf==3.17.0
psutil==5.8.0
ptyprocess==0.7.0
detections/endpoint/detect_exchange_web_shell.yml
+16 -4
View File
@@ -1,8 +1,8 @@
name: Detect Exchange Web Shell
id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a
version: 2
date: '2021-03-09'
author: Michael Haag, Shannon Davis, Splunk
version: 3
date: '2021-10-05'
author: Michael Haag, Shannon Davis, David Dorsey, Splunk
type: TTP
datamodel:
- Endpoint
@@ -12,7 +12,19 @@ description: 'The following query identifies suspicious .aspx created in 3 paths
`\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious
.aspx file will likely look obvious on the surface. inspect the contents for script
code inside. Identify additional log sources, IIS included, to review source and
other potential exploitation.'
other potential exploitation. It is often the case that a particular threat is only
applicable to a specific subset of systems in your environment. Typically analytics
to detect those threats are written without the benefit of being able to only target
those systems as well. Writing analytics against all systems when those behaviors
are limited to identifiable subsets of those systems is suboptimal. Consider the
case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information,
a hunter can limit their analytics to systems that have been identified as Exchange
servers. A hunter may start with the theory that the exchange server is communicating
with new systems that it has not previously. If this theory is run against all publicly
facing systems, the amount of noise it will generate will likely render this theory
untenable. However, using the asset information to limit this analytic to just the
Exchange servers will reduce the noise allowing the hunter to focus only on the
systems where this behavioral change is relevant.'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=System by _time span=1h Processes.process_id Processes.process_name
Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
+30 -34
View File
@@ -1,32 +1,34 @@
name: Malicious PowerShell Process - Connect To Internet With Hidden Window
id: ee18ed37-0802-4268-9435-b3b91aaa18db
version: 6
date: '2020-11-20'
author: David Dorsey, Splunk
type: TTP
version: 7
date: '2021-10-05'
author: David Dorsey, Michael Haag Splunk
type: Hunting
datamodel:
- Endpoint
description: This search looks for PowerShell processes started with parameters to
modify the execution policy of the run, run in a hidden window, and connect to the
Internet. This combination of command-line options is suspicious because it's overriding
the default PowerShell execution policy, attempts to hide its activity from the
user, and connects to the Internet. Deprecated becaue hidden is not needed when
download file with System.Net.WebClient.
search: '| tstats `security_content_summariesonly` count values(Processes.process)
as process values(Processes.parent_process) as parent_process min(_time) as firstTime
max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell`
Processes.process=*-WindowStyle* Processes.process=*hidden* Processes.process="*New-Object*"
by Processes.user Processes.process_name Processes.original_file_name Processes.parent_process_name
Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
- Endpoint
description: 'The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet.
Removed in this version of the query is New-Object.
The analytic identifies all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash.'
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user
Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| where match(process,"(?i)[\-|\/|–|—|―]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]")
| `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
known_false_positives: Legitimate process can have this combination of command-line
options, but it's not common.
references: []
references:
- https://regexr.com/663rr
- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
- https://ss64.com/ps/powershell.html
- https://twitter.com/M_haggis/status/1440758396534214658?s=20
tags:
analytic_story:
- Malicious PowerShell
@@ -77,16 +79,10 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.process
- Processes.process_name
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
- Processes.dest
risk_score: 81
security_domain: endpoint
security_domain: endpoint
detections/endpoint/malicious_powershell_process___encoded_command.yml
+27 -26
View File
@@ -1,27 +1,33 @@
name: Malicious PowerShell Process - Encoded Command
id: c4db14d9-7909-48b4-a054-aa14d89dbb19
version: 5
date: '2020-07-21'
author: David Dorsey, Splunk
version: 6
date: '2021-10-05'
author: David Dorsey, Michael Haag, Splunk
type: Hunting
datamodel:
- Endpoint
description: This search looks for PowerShell processes that have encoded the script
within the command-line. Malware has been seen using this parameter, as it obfuscates
the code and makes it relatively easy to pass a script on the command-line.
- Endpoint
description: 'The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. \
The analytic identifies all variations of EncodedCommand, as PowerShell allows the ability to shorten the parameter. For example enc, enco, encod and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. \
During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use. \
Alternatively, may use regex per matching here https://regexr.com/662ov.'
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process=*-EncodedCommand*
OR Processes.process=*-enc*) by Processes.user Processes.process_name Processes.process
Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user
Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| where match(process,"(?i)[\-|\/|–|—|―]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]")
| `malicious_powershell_process___encoded_command_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: System administrators may use this option, but it's not common.
references: []
references:
- https://regexr.com/662ov
- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
- https://ss64.com/ps/powershell.html
- https://twitter.com/M_haggis/status/1440758396534214658?s=20
tags:
analytic_story:
- Malicious PowerShell
@@ -62,16 +68,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.user
- Processes.parent_process_name
- Processes.dest
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 35
security_domain: endpoint
security_domain: endpoint
detections/network/dns_query_length_with_high_standard_deviation.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: DNS Query Length With High Standard Deviation
id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5
version: 3
date: '2021-07-21'
version: 4
date: '2021-10-06'
author: Bhavin Patel, Splunk
type: Anomaly
datamodel:
@@ -11,10 +11,11 @@ description: This search allows you to identify DNS requests and compute the sta
standard deviation to show you those queries that are unusually large for your environment.
search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution
where NOT DNS.message_type IN("Pointer","PTR") by DNS.query | `drop_dm_object_name("DNS")`
| eval tlds=split(query,".") | eval tld=mvindex(tlds,-1) | eval tld_len=len(tld) | search tld_len<=24
| eval query_length = len(query) | table query query_length record_type count |
eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length)
AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev
| `dns_query_length_with_high_standard_deviation_filter` '
| `dns_query_length_with_high_standard_deviation_filter`'
how_to_implement: To successfully implement this search, you will need to ensure that
DNS data is populating the Network_Resolution data model.
known_false_positives: It's possible there can be long domain names that are legitimate.
docs/_config.yml
+1 -1
View File
@@ -6,7 +6,7 @@ description: >- # this means to ignore newlines until "baseurl:"
mapped to the MITRE ATT&CK Framework, the Lockheed Martin Cyber Kill Chain, and CIS Controls.
They include Splunk searches, machine learning algorithms and
Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.
name: Jose Hernandez
name: Splunk Threat Research Team (STRT)
url: "https://splunkresearch.com"
baseurl: "/" # the subpath of your site, e.g. /blog
url: "https://splunkresearch.com" # the base hostname & protocol for your site, e.g. http://example.com
requirements.txt
+2 -2
View File
@@ -26,7 +26,7 @@ importlib-metadata==4.8.1
importlib-resources==5.2.2
ipaddr==2.2.0
Jinja2==3.0.1
jsonschema==3.2.0
jsonschema==4.0.1
lockfile==0.12.2
MarkupSafe==2.0.1
more-itertools==8.9.0
@@ -38,7 +38,7 @@ pendulum==2.1.2
pep517==0.11.0
Pillow==8.3.2
platformdirs==2.3.0
pre-commit==2.14.1
pre-commit==2.15.0
progress==1.6
prompt-toolkit==1.0.14
pyfiglet==0.8.post1